Download & install
Get Egret. Every way.
The agent runs in your build; the optional dashboard runs on your infra. Pick the path that fits - all Apache-2.0, all self-hostable, no account required.
Egret · the agent
Run Egret in your build
Egress monitoring + enforcement for CI/CD and Linux hosts. Three ways to use it.
1 · GitHub Action recommended
The way to use Egret. Add one step to a workflow and it guards the whole build through eBPF - every connection, process, and file write - against your policy, uploading findings to GitHub Code Scanning as SARIF. In block mode it enforces an egress allowlist. Zero servers, no phone-home, any GitHub runner.
# From the GitHub Marketplace: NX1X/Egret
- uses: NX1X/Egret@v0
with:
mode: audit # or: block
command: make ci # your whole build, monitored end-to-end
fail-on-violations: true # optional
View on GitHub Marketplace → · All Action inputs →
2 · CLI / binary
Wrap any command on a Linux host - no CI required.
# Download the latest release binary for your platform
# https://github.com/NX1X/Egret/releases
chmod +x egret
# Wrap your build (audit mode observes; block mode enforces)
sudo ./egret run --mode audit -- make ci
Releases → · Quickstart & flags →
3 · GitHub App optional · in testing
An optional branded-identity layer on top of the Action - it does not change
what Egret does. With an App installation token, the Action's results post
under an egret-security-app[bot] identity (a pass/fail check-run,
a sticky PR comment, and an allowlist dashboard issue) instead of the generic
bot. Every one of those already works with the built-in GITHUB_TOKEN;
the App only changes the identity. It's in private testing
(owner-only) today - the public, org-wide install-and-done experience ships
alongside self-hosted Egret Nest.
Egret Nest · the dashboard
Self-host the dashboard
Optional. A single static Go binary (pure-Go SQLite, no CGO). Pull the image from either registry - same digest, same build provenance.
Pull the image - two registries, same build
Use whichever you prefer. Identical image, identical digest, identical provenance.
docker pull nx1x/egret-nest:latest
docker pull ghcr.io/nx1x/egret-nest:latest
Run the container
# Set a 32-byte secret key (encrypts TOTP seeds at rest)
docker run -d -p 8080:8080 -v egret-nest-data:/data \
-e EGRET_NEST_SECRET_KEY=$(openssl rand -hex 32) \
nx1x/egret-nest:latest
docker compose
docker compose up -d # dashboard on 127.0.0.1:8080
docker compose --profile tls up -d # + nginx TLS on :443
Helm (Kubernetes)
helm install egret-nest deploy/helm/egret-nest \
--set secretKey=$(openssl rand -hex 32)
Go binary
# Download egret-nest_linux_amd64 from the releases page
# https://github.com/NX1X/Egret-Nest-Dashboard/releases
chmod +x egret-nest_linux_amd64
EGRET_NEST_SECRET_KEY=$(openssl rand -hex 32) ./egret-nest_linux_amd64
Verify
Checksums & build provenance
Every GitHub Release ships a SHA256SUMS file, and every binary +
container image carries SLSA build provenance (keyless, OIDC) -
so you can prove an artifact is exactly what CI built, from this repo.
# 1. Checksums (download SHA256SUMS from the release)
sha256sum -c SHA256SUMS
# 2. Build provenance - binary
gh attestation verify egret-nest_linux_amd64 --repo NX1X/Egret-Nest-Dashboard
# 2. Build provenance - container image (by digest)
gh attestation verify oci://ghcr.io/nx1x/egret-nest:latest --repo NX1X/Egret-Nest-Dashboard
Every link